AZ-400 Question 67

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  The standalone closing bracket ) on RequestId forces you to close the inner table declaration immediately after the word Events. so the correct answer is Logs | where timestamp > ago(2d) | join ( Events ) on RequestId | where continent == 'Asia'

• 2

  Correct Query Structure: A typical Log Analytics query structure for joining tables and applying filters is: Table1 | join (Table2 | where Condition1) on ColumnName | where Condition2 Corrected Query: logs | join (events | where continent == "asia") on requestId | where timestamp > ago(2d)

• 2

  Logs are timestamped and time stamps filters are optimized, so use them first so Logs where timestamp... Then you need to enright the log data with Events data so Join Events Where continent is Europe on RequestID